phil/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retire Gondulf and move StarPunk to v2.0.0 with Pocket ID login

Browse Source 
StarPunk 2.0.0 logs in with Pocket ID and issues its own Micropub tokens
(ADR-064 in the StarPunk repo), so the Gondulf IndieAuth server is no
longer used. Removes its task, templates, Caddy route, subdomain and
service entry, and moves its DNS record to removed_records.

The StarPunk template was still on v1.6.0-rc.2 with Gondulf hairpin
hosts; deploying it would have broken login. It now matches production:
v2.0.0, Pocket ID hairpin, OIDC client from vault_starpunk.pocketid and
the admin sub in starpunk_admin_sub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Phil
2026-10-31 11:52:07 -06:00
co-authored by Claude Opus 5.5
parent a08402f0ac
commit 6dfb58d3f1
13 changed files with 27 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+5 -5
View File
@@ -81,7 +81,7 @@ subdomain.
and the Warhammer RSS feed (09:10).
### Docker role categories (`roles/docker/tasks/<category>/`)
- **infrastructure/**: Caddy, Pocket ID, Gondulf (IndieAuth), Dockge
- **infrastructure/**: Caddy, Pocket ID, Dockge
- **development/**: Gitea (+ act_runner), ByteStash
- **media/**: Audiobookshelf, Kavita, Karakeep (files named `hoarder`), Manyfold
- **productivity/**: Paperless-ngx, Baikal, Syncthing, HeyForm, Dawarich, Obsidian LiveSync, Gokapi
@@ -127,11 +127,11 @@ user (`vault_aws_dns`). It also deletes the records listed under
### SSO (Pocket ID)
Pocket ID (`id.thesatelliteoflove.com`) replaced Authentik on 2026-10-31.
Apps that log in with it: Gitea, ByteStash, Audiobookshelf, Kavita, Karakeep,
Manyfold, Paperless-ngx, Gokapi, GoToSocial. Some read the client from env
Manyfold, Paperless-ngx, Gokapi, GoToSocial, StarPunk. Some read the client from env
vars; Gitea, Audiobookshelf and Kavita store it in their own database (set in
their admin UI). OIDC clients are created in Pocket ID's UI and their ID and
secret go in the vault as `vault_<service>.pocketid`. StarPunk logs in with
IndieAuth through Gondulf instead.
secret go in the vault as `vault_<service>.pocketid`. StarPunk (v2.0.0+) also
runs its own IndieAuth server so Micropub apps can post; Gondulf was retired.
### Shared Docker Network (`lava`)
Created by the docker role as `{{ docker.subnet }}` with `ip_range: {{ docker.ip_range }}`. Docker only hands out dynamic addresses from that range, so `172.20.0.x` is reserved for fixed IPs: Caddy (`docker.hairpin_ip`, .5) and Gitea (`docker.gitea_ip`, .6). Both need fixed IPs because ufw-docker firewall rules point at container IPs. A network without the range (the 2024 original) is migrated once with `migrate-lava-network.yml`.
@@ -146,7 +146,7 @@ extra_hosts:
```
Most often needed for `subdomains.pocketid` (OIDC); also `subdomains.git`
(Gitea itself), `subdomains.gondulf` and `primary_domain` (StarPunk).
(Gitea itself) and `primary_domain` (StarPunk).
### Template pattern
```yaml